Analysis
-
max time kernel
123s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28-12-2024 17:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8a2be8b987ef5bfa48ebadd552e7ee55c7910fd805abc38773a98a330de61e1d.exe
Resource
win7-20240708-en
windows7-x64
12 signatures
150 seconds
General
-
Target
8a2be8b987ef5bfa48ebadd552e7ee55c7910fd805abc38773a98a330de61e1d.exe
-
Size
12.0MB
-
MD5
00781601407e4d52723f37b8a720b4bd
-
SHA1
3416c27ca9af798f84e6994f0d8a54896cb256d6
-
SHA256
8a2be8b987ef5bfa48ebadd552e7ee55c7910fd805abc38773a98a330de61e1d
-
SHA512
4fa965e021159ea3fb805bc3a12de682d002f4cb3d0ca42b7c6cdc97d722a030c0c7e26cc65a19011fb2fc470a8a7ae53cd77472b448e91dab0fa310fbc37951
-
SSDEEP
49152:s/KE1ld3/wAyJxVZp2bnbJ5eA+zOFTCTMqQ:s/KU9/pyJx9Y5ela0T
Malware Config
Extracted
Family
bdaejec
C2
ddos.dnsnb8.net
Signatures
-
Bdaejec family
-
Detects Bdaejec Backdoor. 1 IoCs
Bdaejec is backdoor written in C++.
resource yara_rule behavioral2/memory/1436-10-0x00000000002B0000-0x00000000002B9000-memory.dmp family_bdaejec_backdoor -
resource yara_rule behavioral2/files/0x000d000000023c87-3.dat aspack_v212_v242 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation RVwrSt.exe -
Executes dropped EXE 1 IoCs
pid Process 1436 RVwrSt.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe RVwrSt.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe RVwrSt.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe RVwrSt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe RVwrSt.exe File opened for modification C:\Program Files\7-Zip\7z.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE RVwrSt.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE RVwrSt.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe RVwrSt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe RVwrSt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe RVwrSt.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE RVwrSt.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe RVwrSt.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe RVwrSt.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe RVwrSt.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe RVwrSt.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RVwrSt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8a2be8b987ef5bfa48ebadd552e7ee55c7910fd805abc38773a98a330de61e1d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4816 8a2be8b987ef5bfa48ebadd552e7ee55c7910fd805abc38773a98a330de61e1d.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4816 8a2be8b987ef5bfa48ebadd552e7ee55c7910fd805abc38773a98a330de61e1d.exe 4816 8a2be8b987ef5bfa48ebadd552e7ee55c7910fd805abc38773a98a330de61e1d.exe 4816 8a2be8b987ef5bfa48ebadd552e7ee55c7910fd805abc38773a98a330de61e1d.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4816 wrote to memory of 1436 4816 8a2be8b987ef5bfa48ebadd552e7ee55c7910fd805abc38773a98a330de61e1d.exe 83 PID 4816 wrote to memory of 1436 4816 8a2be8b987ef5bfa48ebadd552e7ee55c7910fd805abc38773a98a330de61e1d.exe 83 PID 4816 wrote to memory of 1436 4816 8a2be8b987ef5bfa48ebadd552e7ee55c7910fd805abc38773a98a330de61e1d.exe 83 PID 1436 wrote to memory of 1528 1436 RVwrSt.exe 101 PID 1436 wrote to memory of 1528 1436 RVwrSt.exe 101 PID 1436 wrote to memory of 1528 1436 RVwrSt.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a2be8b987ef5bfa48ebadd552e7ee55c7910fd805abc38773a98a330de61e1d.exe"C:\Users\Admin\AppData\Local\Temp\8a2be8b987ef5bfa48ebadd552e7ee55c7910fd805abc38773a98a330de61e1d.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\RVwrSt.exeC:\Users\Admin\AppData\Local\Temp\RVwrSt.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\2c3578df.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:1528
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
187B
MD5d660eadeaf209eb05b5526beb7f59dc1
SHA1ec8bd3a74e95f2bb56891cd1d08e09dbed080606
SHA25629ffb9af81e3fc7dc4a6c0a5556f1e25cc1892670e99988ca7b28ed4c65bbfea
SHA512292c27eb860fda6d7229f36ffa507f2f863e13dfa461020cd4dcfaf8b81a4932a6843693d0b4ffaa9b418b47a0c9e49576dde2f25adcf492cb95520802d3c780
-
Filesize
15KB
MD556b2c3810dba2e939a8bb9fa36d3cf96
SHA199ee31cd4b0d6a4b62779da36e0eeecdd80589fc
SHA2564354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
SHA51227812a9a034d7bd2ca73b337ae9e0b6dc79c38cfd1a2c6ac9d125d3cc8fa563c401a40d22155811d5054e5baa8cf8c8e7e03925f25fa856a9ba9dea708d15b4e